Software Validation in QMS: The Clause Everyone Ignores Until Audit Day
If you are using software in your QMS—Excel, SharePoint, eQMS platforms—it must be validated under ISO 13485. Most companies skip this, making their entire system non-compliant.
This is one of the fastest ways to fail an audit.
The Reality: Your QMS Software Is Probably Not Validated
If you use:
- Excel trackers
- SharePoint systems
- eQMS platforms
- Custom databases
Then you are using software that impacts quality—and must be validated.
This requirement comes directly from ISO 13485 Clause 4.1.6.
Learn the full requirement here: ISO 13485 Clause 4.1 General Requirements
Why This Gets Missed
Most companies assume:
- “It’s just Excel”
- “It’s a standard system”
- “The vendor handles validation”
All incorrect.
You are responsible for validation.
What ISO 13485 Actually Requires
You must validate software used in the QMS before use and after changes.
This includes:
- Ensuring intended use is defined
- Testing functionality
- Documenting results
- Maintaining validation over time
What Auditors Look For
They will ask:
- What software do you use?
- How is it validated?
- What happens when it changes?
If you cannot answer clearly, it becomes a finding.
Common Failures
1. No Validation Evidence
No documented testing or validation records.
2. No Defined Intended Use
You cannot validate software if you haven’t defined what it should do.
3. No Change Control
Updates happen—but no revalidation is performed.
4. Over-Reliance on Vendors
Vendor validation ≠ your validation.
How to Fix This
Step 1: Identify All QMS Software
- Document control systems
- CAPA systems
- Audit tools
- Training systems
Step 2: Define Intended Use
What does the software do in your QMS?
Step 3: Perform Validation
- Test key functions
- Document results
- Approve for use
Step 4: Maintain Control
Link software into:
Tools to Solve This Quickly
Final Takeaway
If your software is not validated, your QMS is not compliant.
Most companies only realise this during an audit.
The ones that pass already fixed it.
